From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f52.google.com (mail-qv1-f52.google.com [209.85.219.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C8523DDB02 for ; Fri, 17 Jul 2026 10:39:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784284747; cv=none; b=q/5PfViJOQr4cekXzKt6bnUOkYVNonukkJJyvgaXzOyz3IZO0WUvhZ+cKsnjCIyU25zB8OlVdJA6L3nPASUD//h7bo74VzuUu3LeCXy7V1H/tLKgp3Ssdq0STsFotaB2z1HpiPuMhsQZ/+VdNVD1GxpNb0+xRrdCIe/T7KQMw0g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784284747; c=relaxed/simple; bh=+zLMKrES4StXAGONdQ/PirqGxPFtSlajROJvN8za6Qo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=CXgU/RPUA/IxMxo9aGJ69LCrpYok9DtT6WqhA1+H+NSWcICZcuj+509gIc7ArGPC4mj9NR1kqOun9FBWVHfUpRQ7yzpyFsgWOq6SaWNN4aBWZ7z2Qr3v2aLfTeGrTVjbpdCuExrTKLJb2D1n6tMsJaNVBLL9PXPilr+YsmhccNA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=JXRX0R1h; arc=none smtp.client-ip=209.85.219.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="JXRX0R1h" Received: by mail-qv1-f52.google.com with SMTP id 6a1803df08f44-9034b6b7674so59454386d6.0 for ; Fri, 17 Jul 2026 03:39:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1784284745; x=1784889545; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=3riQ9T4y5IQhg/VW8hsSvvb11bNPX91gfNywMrlwLaM=; b=JXRX0R1hWBnuUNDgPDFURiJJoOyuEOAV5yRsFXdM/4HtQ63/EMXGSU+ukIBOyCraMM dBAS6OWQxdMxrAlpKqu8yd8uLyhp+GyMgK9Rd81/w3gyqnYSVt4iYu6cLoG2RdAadjrl KKLuKO5kU/1YjSnZLYia2dBmXoI28j8G194C4MgGYUtmHreZoAeLA/CLAexRcaLIaZlM +VinD6JtuSWEdNHdg5A+Wg9T7wI15LAX9OH1F2XOh0Rwp8gJS3jIyL1JdVU7XVRbK9VX m0msFHXzFOCwNrqRrX47+XuyKEOMGJZHNgTX5QMXcPHOq3BPVkdXfSP7CIyOusuhuebd roMw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784284745; x=1784889545; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3riQ9T4y5IQhg/VW8hsSvvb11bNPX91gfNywMrlwLaM=; b=oQQFbkfVeiaiYpjavFr9dDJmHX/GdWjsNmsXvNaWJncv499+qH8bPDz0d+imdUPlsv uZu7rg/rJ8+tMzcfAggNb3PqsX8OMq0tuYj8pvQ5H+6SHSGlLQcGpN5u+jHfO54bKkiv rqk8Xkmz9njydsV1kHGbM4z84Qts/lb1TKbswC3MS/9KonGWhhH+nbYgxno2X2RAwNlp Wke2Dec5YcJDHaX4bhKK8vwTP9rLWJpYqpM2kSHsKJWi+viQ+bT8gJzA+NN90/+cFk/U o+B7oeyzSHY5ui0o49NP3s6K+8evhLg8+MJpn3TVG02HjQiwg6LNHzW8/XqxROcPV9ct n/Hg== X-Forwarded-Encrypted: i=1; AHgh+RoE3JWg0vFj3J0AE/T8NJg4AjAuesEAFtFhZ65JHusE+7f8CI7dH1l1pYb3LrY8utyGCzkEhH0kcJhXSas=@vger.kernel.org X-Gm-Message-State: AOJu0YxDJ6zLAuZI/ezR1QSnUtr/S2za7+9I3ujFfoniYK5RYmxVWzR0 GXt1AAJ5/gu7+KDp8ZZ3s8GrSA4jGt/nnZgH68DE8aX2mQhBMioPVMWyU4rXvOUhv4E= X-Gm-Gg: AfdE7cmPQhc7uXpSOocL+MmyJw+6+ryogdF/7iUS/V9zqpubY0gXqhd4seqb6XdpzrD OB7RY3navd0QZmO88pVdRvn77Uy7M4VKricubWmbHj7ej5VPMMujYoHdsGtlgahPfNhWhGHWo+W /b0NNdyqaTFVuUjEqvxqhrlx5y1bKNEH6L4sfdbX4LltLFAbBGpmW6GMCoRyn2UZYQgjbmgC7KW /ENBwCaxw/EWIdI8SNQuWaz7pq5wNbagcgQSU7IP+dhQb04NRqRDmkUrEaCon+TLZnsZBxSKm0g sWldCx/mX0Rn8U56uKIaQ+a5fi0VqnTDMB2sKOLrIwiXb70g2d5m0WnBuqdIgVv6rABmG+e0AqP fAeRJYbXrMuLgxMdirgdRVwjd4xjkoYzulx9Y0SlVy5shLhfPfz4a/iUq6pv6u+ZpxeUtoNsMl1 ngZcSf0sU= X-Received: by 2002:a05:6214:29c9:b0:8f0:c969:596a with SMTP id 6a1803df08f44-907784e237bmr22510666d6.56.1784284745483; Fri, 17 Jul 2026 03:39:05 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id 6a1803df08f44-9077853fa7dsm14597306d6.7.2026.07.17.03.39.04 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 17 Jul 2026 03:39:05 -0700 (PDT) From: David Lee To: Breno Leitao Cc: David Lee , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, Dominik 'Disconnect3d' Czarnota , linux-kernel@vger.kernel.org Subject: [PATCH] netconsole configfs target release NULL dereference Date: Fri, 17 Jul 2026 10:39:02 +0000 Message-ID: <20260717103903.38514-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit configfs target release can call netpoll cleanup with missing netpoll state. Mark targets as disabled before releasing their netpoll state and skip cleanup when no netpoll device is present. This prevents teardown races from reaching netpoll cleanup after nt->np.dev has already been cleared. Fixes: 97714695ef90 ("net: netconsole: Defer netpoll cleanup to avoid lock release during list traversal") Signed-off-by: David Lee Assisted-by: Codex:gpt-5.5 --- drivers/net/netconsole.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index 862001d..ad30e2e 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -287,6 +287,8 @@ static bool bound_by_mac(struct netconsole_target *nt) static void netcons_release_dev(struct netconsole_target *nt) { + if (!nt->np.dev) + return; do_netpoll_cleanup(&nt->np); if (bound_by_mac(nt)) memset(&nt->np.dev_name, 0, IFNAMSIZ); @@ -1490,10 +1492,12 @@ static void drop_netconsole_target(struct config_group *group, */ needs_cleanup = nt->state == STATE_ENABLED || nt->state == STATE_DEACTIVATED; - /* Disable deactivated target to prevent races between resume attempt - * and target removal. + /* Disable targets that still own netpoll state before removal. This + * prevents races between open configfs writers, resume attempts, and + * target removal from observing STATE_ENABLED after netpoll_cleanup() + * has cleared nt->np.dev. */ - if (nt->state == STATE_DEACTIVATED) + if (needs_cleanup) nt->state = STATE_DISABLED; list_del(&nt->list); spin_unlock_irqrestore(&target_list_lock, flags);